Regina Public Library will be showing films related to the public s right to know throughout the week at the central library.

Transcription

1 FOIP FOLIO WELCOME TO ANGELA September 2007 Welcome to our new Portfolio Officer, Angela Markel. Angela grew up in Regina and Moose Jaw, and attended University of Saskatchewan for undergraduate studies and law school. However, she spent the last five years in Edmonton, where she worked as a Case Manager for the Municipal Government Board and as a legislative planner for Alberta Municipal Affairs & Housing. Her experience with an administrative tribunal, which included writing numerous Board decisions and giving presentations to municipalities, will make her a valuable addition to our OIPC team. Angela is very excited to be back in Saskatchewan and is looking forward to the challenging and interesting work of information access and privacy. SASKATCHEWAN RIGHT TO KNOW WEEK September 28, 2007 is International Right to Know Day. In Canada, the week of October 1-5, 2007 has been designated as Right to Know Week. The purpose is to draw attention to the importance of access to information laws and procedures in ensuring that public bodies are transparent and accountable to citizens. The Saskatchewan Government and the cities of Regina and Saskatoon will officially proclaim October 1-5, 2007 as Right to Know Week. In Saskatchewan, and almost every other province, many events have been organized during Right to Know Week. The events organized by the Saskatchewan Right to Know Committee are described at under the Right to Know tab. Right to Know events include the following: October 1-5, 2007 Regina Public Library will be showing films related to the public s right to know throughout the week at the central library. Tuesday, October 2, pm-6pm Right to Know Reception featuring John Reid SIPP Saskatchewan Institute of Public Policy University of Regina, College Ave. Campus, Gallery Building, 2 nd Floor Presentation of Chief Justice E.M. Culliton Award Keynote Speaker: John Reid, former Information Commissioner of Canada. Wine and Cheese Reception to follow - 1 -

2 SASKATCHEWAN RIGHT TO KNOW WEEK (CONT D) Wednesday, October 3, pm-2pm Right to Know Luncheon featuring John Reid Faculty Club, University of Saskatchewan Keynote Speaker: John Reid, former Information Commissioner of Canada Thursday, October 4, am-12pm SIPP Lecture Series (in association with the U of R Library) Privacy and the Right to Know: Rights, Complications and Limitations University of Regina, College Ave. Darke Hall Speaker: David Fewer, Staff Counsel, Canadian Internet Policy and Public Interest Clinic, Ottawa CONTRIBUTORS Thanks to the contributors to Right to Know Week in Saskatchewan: McKercher McKercher & Whitmore LLP, Saskatchewan Law Foundation, Canadian Bar Association, Saskatchewan Institute for Public Policy, City of Regina; McPherson Leslie & Tyerman LLP, Regina Public Library, and the Office of the Saskatchewan Information and Privacy Commissioner. If you would like more information about these events, contact us at (306) GOOGLE STREET VIEW CONCERNS CANADIAN PRIVACY COMMISSIONER Google s new Street View product allows users to navigate streets and neighbourhoods in larger Canadian cities. It also allows the user to focus and zoom in on street level photographs that capture individuals present when the street-level photos were taken. Canada s Privacy Commissioner, Jennifer Stoddart, recently wrote to Google and the Canadian company that has been providing some of the photographs for the new product (Immersive Media Corp. of Calgary) questioning what precautions and safeguards have been installed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). You can access the correspondence from Commissioner Stoddart at

3 VALUABLE INSIGHT INTO CONSENT FOR YOUTH For Saskatchewan health information trustees there is a useful article just published in the periodical, Health Law in Canada -- Adolescent Minors, Informed Consent and Health Information Privacy: Balancing Paternalism, Health and Autonomy in the Reproductive Health Care Context (pg. 16). This is focused very much on Ontario s Personal Health Information Protection Act but will be of interest to any Saskatchewan trustee who needs to apply section 56(c) of The Health Information Protection Act (HIPA). That provision allows any right or power conferred on an individual by HIPA to be exercised by an individual who is less than 18 years where in the opinion of the trustee, the individual understands the nature of the right or power and the consequences of exercising the right or power. In the context of reproductive health care, Canadian courts have been guided by a UK 5 step process: (1) can the patient understand the doctor s advice, (2) the patient cannot be persuaded to inform her parents or allow the doctor to inform them, (3) the patient is very likely to have sexual intercourse with or without contraceptive treatment, (4) the patient requires contraceptive advice or treatment to avoid physical or mental harm and (5) her best interest require contraceptive advice treatment or both. If those questions are answered in the affirmative, the doctor could proceed without consent or knowledge of the parents. The author, Nyranne Martin, suggests that given the balance in favour of protecting the privacy and confidentiality of adolescent minors, the presumption in (2) above, that attempts should always be made to encourage the minor to speak with their family, should be rejected. Health Law in Canada is published by LexisNexis Canada Inc. hlic@lexisnexis.ca or phone ( ). ONTARIO IPC ORDERS OTTAWA POLICE SERVICE TO DESTROY PERSONAL INFORMATION IMPROPERLY COLLECTED Ontario Information and Privacy Commissioner, Ann Cavoukian, issued an unusual order on September 11, She was investigating a concern that the Ottawa police s collection of information relating to an individual who had sold items to second-hand shops was in contravention of the Municipal Freedom of Information and Protection of Privacy Act. Police were collecting data transmitted to them by the shops using a system developed by Business Watch International (BWI), a company based in Regina. BWI maintained the identifiable information for the benefit of police officers in Ottawa and also for police services across Canada. The fields of personal information included name, date of birth, approximate height and approximate weight. The six different forms of approved photographic identification would potentially reveal other personal information such as - 3 -

4 ONTARIO IPC ORDERS OTTAWA POLICE SERVICE TO DESTROY PERSONAL INFORMATION IMPROPERLY COLLECTED (CONT D) race, national origin, sex, marital status, criminal history, identifying numbers such as driver s licence or passport number or residential address. The Commissioner was not satisfied that it was necessary for the shops to collect such a wide range of personal information on personal sellers. For the first time in Ontario, the Commissioner issued a cease collection and destruction order. She described the large electronic database maintained by BWI on behalf of police (with records of more than a quarter-of-a-million used good transactions involving 44,128 individuals) as a grave infringement to the privacy rights of individuals. The police are not required to obtain a warrant or demonstrate any suspicion of wrongdoing, in order to access the database, while every individual who sells an item to a second-hand goods store may become subject to scrutiny by the police, even though it is clear that the vast majority are innocent, law-abiding citizens who have committed no offence. This Order can be accessed at ALBERTA ENERGY AND UTILITIES BOARD (EUB) VIOLATED FOIP BY COVERT SURVEILLANCE The Office of the Alberta Information and Privacy Commissioner issued its investigation report on September 13, 2007 dealing with the actions of private investigators, hired by the EUB, to monitor opponents of a high voltage power line proposal. It was alleged that one of the private investigators had posed as an aggrieved landowner to participate in at least one conference call, which involved landowners and groups opposed to the power line. The OIPC investigation determined that the personal information collected was not necessary for the proceedings and was not for the purposes of law enforcement. As a result the collection was not authorized by the AB FOIP Act. The EUB also breached FOIP by failing to ensure there were safeguards in place to protect personal information against such risks as unauthorized access, collection, use, disclosure or destruction. The full text of the Investigation Report F2007-IR-005 can be accessed at INFORMATION SESSIONS FOR LOCAL AUTHORITIES The Local Authority Freedom of Information and Protection of Privacy Act Local authorities in Saskatchewan including municipal governments, regional health authorities and many health facilities, library boards, elementary, secondary and post secondary educational authorities are all subject to The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP)

5 INFORMATION SESSIONS FOR LOCAL AUTHORITIES (CONT D) The Local Authority Freedom of Information and Protection of Privacy Act LA FOIP provides members of the public with a right to access records in a local authority and provides legal privacy protection for the personal information in the custody or control of a local authority. The Departments of Justice, Advanced Education and Employment, Government Relations, Health and Learning are hosting a series of information sessions about LA FOIP in November and December for local authorities. Attendees will receive an overview of LA FOIP, information to help you respond to access to information requests, a discussion of privacy and presentation of some tools to help you assess your readiness and a review of education and training opportunities available to you and your staff. Sessions will be held in: North Battleford, November 20, 2007 Saskatoon, November 21, 2007 Prince Albert, November 22, 2007 Yorkton, November 27, 2007 Swift Current, November 29, 2007 Regina, December 5, 2007 There is no cost to you for this important training; however, you are required to register for the session of your choice by November 9, Due to limited space, registration is limited to one person per local authority. Please contact the Access and Privacy Branch of Saskatchewan Justice at or by ing access&privacy@justice.gov.sk.ca for more information. SOME SK PUBLIC BODIES COULD BE MORE TRANSPARENT We have encountered some public bodies that take the view that the names and employment contact information for their employees is protected personal information. This is contrary to the spirit and the letter of our access and privacy legislation. Under both FOIP and LA FOIP, personal information of public sector employees explicitly does not include the name of an employee and the classification, salary, discretionary benefits or employment responsibilities of the employee

6 SOME SK PUBLIC BODIES COULD BE MORE TRANSPARENT (CONT D) In some cases, we are advised that the reason for such non-disclosure is to protect the employee. There is provision in both FOIP and LA FOIP that permits refusal of access to a record if the disclosure could threaten the safety or the physical or mental health of an individual (s. 21 FOIP and s. 20 LA FOIP). This is an extraordinary provision however, that should rarely be invoked. It certainly is not proper to indiscriminately invoke this provision to deny disclosure of this business information for all employees in a public sector organization. LOST HARD DRIVE EXPOSES PERSONAL HEALTH DATA ON 3,300 ONTARIO PATIENTS The Hospital for Sick Children in Toronto is scrambling to respond to the loss of an external hard drive at Pearson Airport in April. The files included patient names, dates of birth, diagnoses, ophthalmologic images and photographs of eyes and eye injuries. Patients were not notified of the data breach until August 28. This occurred six weeks after Ontario s Information and Privacy Commissioner ordered the hospital to take corrective action including installing an encryption feature on laptop computers. That IPC order followed the theft of a laptop computer from a doctor s vehicle (The Toronto Star, August 23, 2007, Megan Ogilvie). HOMELAND SECURITY PRIVACY AUDIT UTILIZES REAL DATA The Government Accountability Office of Congress (GAO) identified in July that to test the general functionality of new technology the department of Homeland Security utilized real data and birth dates of persons crossing the US-Canada border. It appears that in some cases the data was used to produce classified intelligence information. The GAO concluded that the use of real data for test purposes without undertaking a Privacy Impact Assessment created unnecessary privacy risks. (CanWest News Service, The Windsor Star, Sept. 6, 2007, Randy Boswell). We cautioned against the use of personal information in running tests of computer systems in the April-May 2006 FOIP Folio (pg. 4)

7 INTERNATIONAL WORKING GROUP ON DATA PROTECTION IN TELECOMMUNICATIONS At a meeting this month in Berlin, the International Working Group on Data Protection in Telecommunications produced a refined working paper on Privacy Issues in the Distribution of Digital Media Content and Digital Television. The Working Group observed as follows: One of the major threats introduced by these new ways of distribution of digital media content is the possibility to combine the emotional power of television (people relaxing at home, more open to react openly without any inhibition) with the transactional power of the Internet (data mining, user modeling, intelligent agents, etc.) to gather sufficiently individualized personalized information about any viewer to adapt immediately and accordingly his viewing experience and even to modify his behaviour. The working paper suggests the anonymous use of digital television must be maintained and outlines 7 recommendations to achieve that aim. At the same meeting, the Working Group also produced a working paper on E-Ticketing in Public Transport. This is a response to the proliferation of smart cards for purposes of increased efficiency of public transport services. There is the potential for the tracking of individual users movements and whereabouts. The thrust of this paper is to ensure that the cardholder should be able to control information concerning his use of the card. FUTURE EVENTS September 20-21, 2007 Private Sector Privacy in a Changing World (PIPA Conference 2007) Vancouver, British Columbia (visit for details) September 24, 2007 Health Information Privacy Day, Toronto, Ontario (visit for details) September 24, 2007 Data Protection Commissioners Francophone Conference Montreal, Quebec (visit for details) September 25-28, th International Conference of Data Protection and Privacy Commissioners Conference Montreal, Quebec (visit for details) October 1-5, 2007 Right to Know Week (visit for details) - 7 -

8 FUTURE EVENTS (CONT D) October 9, 2007 CBA Privacy and Access Law South: Privacy Considerations in Business Transactions Hotel Saskatchewan, Regina Speaker: Kirk Nordick, Kanuka Thuringer LLP (visit for details) October 10, 2007 CBA Privacy and Access Law North: Privacy Considerations in Business Transactions Saskatoon Club, Saskatoon Speaker: Kirk Nordick, Kanuka Thuringer LLP (visit for details) October 25-26, 2007 The Revealed I, A Conference on Privacy and Identity - Faculty of Law, University of Ottawa (visit for details) TO CONTACT US: Office of the Saskatchewan Information and Privacy Commissioner Hamilton Street Regina, Saskatchewan, S4P 4B4 Telephone: (306) / Toll Free: Fax: (306) webmaster@oipc.sk.ca Website: If you wish to subscribe to the Saskatchewan FOIP FOLIO, please send your address to webmaster@oipc.sk.ca - 8 -